PT-2022-11770 · Fortinet · Fortiwlm

Published 2022-03-02 · Updated 2022-03-09 · CVE-2021-43070

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiWLM management interface versions 8.6.2 and below FortiWLM management interface versions 8.5.2 and below FortiWLM management interface versions 8.4.2 and below FortiWLM management interface versions 8.3.3 and below FortiWLM management interface version 8.2.2

Description The issue allows an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests. This is due to multiple relative path traversal vulnerabilities in the FortiWLM management interface.

Recommendations For FortiWLM management interface versions 8.6.2 and below, update to a version above 8.6.2 to resolve the issue. For FortiWLM management interface versions 8.5.2 and below, update to a version above 8.5.2 to resolve the issue. For FortiWLM management interface versions 8.4.2 and below, update to a version above 8.4.2 to resolve the issue. For FortiWLM management interface versions 8.3.3 and below, update to a version above 8.3.3 to resolve the issue. For FortiWLM management interface version 8.2.2, update to a version above 8.2.2 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-43070

Affected Products

Fortiwlm

References · 4

• https://fortiguard.com/psirt/FG-IR-21-106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43070 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43070 · Vendor Advisory
• https://t.me/cibsecurity/38313 · Telegram Post